VU#645818: Xerj Console API Authentication Bypass Leads to Unauthorized Credential Minting
2026-10-20T20:52:01Z•bbab966ff560601ebc622d40ecb9f9d4ed4951a27526a2d27d8dbaefbb03b4cc
CVE-2026-100156CVE-2026-16753CVE-2026-34073CVE-2026-3547CVE-2026-3833CVE-2026-96679CVE-2026-96681CVE-2026-97406account-takeoverauthentication-bypassauthorization-bypasscertificate-validationcommand-injectioncontainer-securitycredential-theftcross-tenant-data-exposuredata-exfiltrationidorjwtllm-securityname-constraintspersistent-accessprivilege-escalationremote-code-executionroot-code-executionsupply-chain-securitytlsx509xss
What happened
CERT/CC advisories describe multiple vulnerabilities, including authentication bypasses, authorization and tenant-isolation failures, OS command injection, credential minting, certificate Name Constraints validation inconsistencies, and XSS leading to token theft and potential RCE. The most severe issues enable unauthenticated administrative takeover or authenticated root-level command execution, while the TLS findings depend on affected validation paths and deployment context.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- certcc_vulnotes
- Record identifier
- bbab966ff560601ebc622d40ecb9f9d4ed4951a27526a2d27d8dbaefbb03b4cc
- Enrichment time
- 2026-10-20T20:52:01Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.